Re: Q : iptables script?

From: Jari Laurila (jlaurmi_at_systemshock.iwantspam.org.invalid)
Date: 10/25/03


Date: Sat, 25 Oct 2003 16:16:27 +0300

On Fri, 24 Oct 2003 22:44:05 -0700, Felix Tilley wrote:

> Is this the right way to do it?
>
> And how do I make it log and drop at the same time?
>
> ========================================
>
> #!/bin/bash
>
> iptables -A INPUT -s 200.0.0.0/8 -j LOG --log-level debug
> iptables -A INPUT -s 4.0.0.0/8 -j LOG --log-level debug
> iptables -A INPUT -s 12.0.0.0/8 -j LOG --log-level debug
> iptables -A INPUT -s 24.0.0.0/8 -j LOG --log-level debug

Why don't you make your own chain to do the both operations.

iptables -N LOGDROP
iptables -A LOGDROP -j LOG --log-level debug
iptables -A LOGDROP -j DROP

After creating the chain, you can use it as target in your scripts.

iptables -A INPUT -s 200.0.0.0/8 -j LOGDROP

-- 
Jari Laurila